~/jwright

Platform & Infrastructure Engineer

Jonathon Wright

Building secure Kubernetes platforms, automated infrastructure fleets, and GPU-backed edge systems.

RHELKubernetesGitOpsAnsibleObservabilityEdge AI

View Projects →Download CVContact
~/jwright ▸6 single-node Talos clusters / 0 SSH daemons / every node rebuilt from committed config
cavealfredrobinkatewgirlelfastcnvidia computeintel computecore / services

01About

Reliability you can reason about.

I'm an infrastructure and platform engineer. I spend most of my time on the automation people usually leave in runbooks: store-edge Kubernetes running GPU-backed AI workloads, the GitOps pipelines that deploy them, and the network policy that keeps a fleet behaving the same way on every node. Before that I worked across larger enterprise estates - around a thousand VMs, multi-region migrations, segmented networks. I like infrastructure that can be rebuilt and explained from the repo. If a deployment still depends on someone remembering the right sequence of clicks, there's usually another piece worth automating.

Based
Sydney, Australia
Focus
Edge Kubernetes · GPU/AI · IaC & GitOps

# education

  • Advanced Diploma in IT Networking and Security
  • Diploma in IT Networking
  • Certificate IV in IT Networking

Download full CV (PDF)

  1. Infrastructure / DevOps Engineer

    Aug 2025 - Present

    Woolworths

    Core DevOps infrastructure engineer for store-edge solutions - turning high-level designs into single-touch deployments and CD pipelines.

    • Single-touch deployment of an edge AI solution running on Kubernetes at the store edge
    • GPU brought online as code - passthrough via ESXi, end-state manifests / Helm charts
    • Ansible playbook builds wired through a single source-of-truth pipeline with per-store vars
    • Removed manual practices across infra and ops - IaC throughout, spec-driven and documented as code

  2. Infrastructure Systems Engineer

    Aug 2022 - Aug 2025

    Virtus Health

    Global IT - optimisation, implementation and projects across an enterprise estate.

    • Managed ~1,000 VMs across a global VMware estate
    • Re-segmented flat sites into isolated VLAN ranges; SD-WAN and Aruba ClearPass onboarding
    • Migrated workloads to Azure (Blob, AVS); upgraded Palo Alto / FortiGate firewalls
    • Led a new major-site build - end-to-end services implementation

  3. Global IT Infrastructure Engineer

    Sep 2019 - Aug 2022

    Linde Asia Pacific

    Maintained and modernised global infrastructure to enterprise standards across the region.

    • Global VMware / Dell hosting; PowerShell automation of manual project tasks
    • Migrated company infrastructure off Google Cloud and Google Workspace to Microsoft: Linux domain controllers replaced with Windows Active Directory, users onto Microsoft 365 and Azure; AWS-hosted ERP access
    • ERP hardware refresh onto new mainframe plus DR solution - including daily COBOL green-screen operations; PBX → VoIP across AU/NZ

+ 2 earlier roles (ELGAS, Darktime) - see the CV.

02Capabilities

What I work with, grouped by what it's for.

FLAGSHIP

Edge AI & GPU

Serving vision and language models on real hardware at the edge.

  • Fail-closed computer vision on single-node OpenShift - probes that catch a silently dead model, not just a dead pod.
  • One GPU, two workloads - a single card time-sliced between LLM serving and video transcode instead of reserving separate hardware.
  • Vendor video-analytics stacks re-platformed as first-class Kubernetes workloads, not appliances.
  • Local models behind an OpenAI-compatible gateway - swap the backend, keep every client.
  • NVIDIA GPU Operator
  • GPU passthrough (ESXi, as code)
  • GPU readiness probing & watchdogs
  • Pod lifecycle management
  • YOLO / computer-vision inference
  • Local LLM serving (llama.cpp)
  • Edge Kubernetes

Platform & Virtualization

Kubernetes platforms designed to be reasoned about and recovered.

  • Kubernetes
  • OpenShift
  • Talos Linux
  • vSphere / VMware ESXi
  • Proxmox
  • containerd
  • Argo CD / GitOps
  • Helm & Kustomize

Automation & IaC

Single-touch deployments - removing the manual step, not documenting it.

  • Ansible / AWX
  • PowerShell (PowerCLI)
  • Python
  • Bash / Shell
  • Terraform
  • Image pre-pull & air-gapped registries (ACR / NVCR)
  • Secrets management

Networking & Security

Default-deny, segmentation, and a small attack surface.

  • SD-WAN
  • 802.1Q VLAN segmentation
  • ACLs / IPSec / RADIUS
  • Aruba ClearPass
  • Palo Alto / FortiGate
  • Firewall policy governance
  • RBAC · 2FA / SSO

Cloud & Identity

Hybrid estates across the major clouds, with identity done properly.

  • Azure
  • Entra ID
  • Intune
  • AWS
  • GCP
  • Microsoft 365
  • Azure Blob / S3

Observability & Ops

Knowing the system is healthy - and the GPUs with it.

  • Fleet metrics by remote-write - every cluster ships to one Prometheus, GPUs included (DCGM / Intel Xe).
  • Alerts that reach a phone and mean it - tuned until silence means healthy, not unmonitored.
  • A backup is a rumour until a restore drill proves it - drills are scheduled, not aspirational.
  • Prometheus
  • Grafana
  • DCGM Exporter
  • PRTG / LibreNMS
  • AWX job reporting
  • Veeam backup
  • ITIL processes

03Selected work

Platforms built to keep working unattended.

DOSSIER / 001

Single-Touch Edge AI Platform

Outcome Turned a high-level edge-AI design into a single-touch deployment running on Kubernetes at the store edge.

  • Kubernetes
  • Edge
  • NVIDIA GPU
  • CD pipelines
  • Helm
  • Python

Infrastructure / DevOps Engineer · Woolworths · 2025 - Present

DOSSIER / 002

Self-Hosted AI & Homelab Platform

Outcome A homelab - GitOps from bare metal to local AI, and the platform that serves this very site.

  • Talos
  • OpenShift
  • Argo CD
  • Proxmox
  • Local LLM
  • Cloudflare Tunnel

Owner / Operator · Ongoing

DOSSIER / 003

IaC Fleet Automation

Outcome Stood up identical edge sites from code - every store comes up the same way, every time.

  • Ansible
  • AWX
  • GitOps
  • ACR / NVCR
  • Image pre-pull
  • Secrets mgmt

Automation Engineer · 2025 - Present

DOSSIER / 004

The Exploded Cluster

Outcome A scroll-driven teaching site that takes container platforms apart one machine at a time.

  • Dependency-free static build
  • GSAP ScrollTrigger
  • Strict CSP
  • Cloudflare Tunnel
  • Argo CD
  • zot mirror

Author / Engineer · 2026

DOSSIER / 005

The Mirror: A Pull-Through Registry

Outcome Ended anonymous registry rate-limits across a six-node fleet, then published the failure modes the deployment revealed - including the one that contradicted my own first write-up.

  • zot v2.1.17
  • Talos Linux
  • containerd
  • OCI distribution
  • Argo CD
  • External Secrets

Author / Engineer · 2026

All projects →

04Writing

Notes from the build.

Lessons from edge Kubernetes, GPUs, and running infrastructure like it matters - written up as I go.

  1. PLATFORM SERIES · 12·8 min read

    413 restarts, and not one could reach the fault

    A liveness probe restarted a container over and over without once repairing it, because the broken state lived in the pod's network namespace rather than inside the container. Detection and remediation are separate jobs, and a restart only heals when the fault sits inside the thing being restarted.

    • platform
    • kubernetes
    • reliability
    • debugging
    • homelab
  2. NETWORKING SERIES · 07·8 min read

    One way in, and a dead route looks like a dead estate

    A broken route into a network is indistinguishable from every service in it being down, because the evidence available from outside is identical in both cases. The fix is an order of diagnosis - prove the service from a chair that is not yours, then walk the path - and a gate that is never a tenant of the building it lets you into.

    • networking
    • vpn
    • tailscale
    • reliability
    • debugging
    • homelab
  3. SECURITY SERIES · 09·9 min read

    A mirror saves the download, not the dependency

    A pull-through mirror turns repeated image downloads into cache hits, but a cache that re-checks tags and falls back to the origin has not removed the upstream from your availability story. What it must do, and does not by default, is serve the exact manifest it was given, because an image digest is the hash of that manifest.

    • security
    • supply-chain
    • registry
    • zot
    • containers
    • talos
    • homelab

Read the blog →

05Get in touch

Let's talk infrastructure.

Open to conversations about platform engineering, edge infrastructure, and GPU/AI systems. Based in Sydney, Australia - for a low-ms reply, ping me on LinkedIn or email; everything else is best-effort delivery.

[email protected]Download CV (PDF)